[claponcet]

What Does This Do

Give Java Lambda ATO and SDK events the same client-IP context as HTTP server integrations, respecting the existing resolution settings. Publish the inferred IP before request evaluation.

Motivation

Login and custom-event tracking in Lambda need client-IP information for ATO support without introducing an agent-bootstrap dependency into dd-trace-core.

Additional Notes

ClientIpAddressResolver and its parsing helper now live in internal-api. HTTP and Lambda share header/peer precedence; an invalid peer preserves a valid header address.

Validation: 475 targeted resolver, HTTP, Lambda, and standalone-jar tests passed. Agent packaging and formatting passed. Companion system-tests PR: DataDog/system-tests#8352.

Exploratory JMH results before this refactor showed approximately 0.05–0.23 µs added for source/forwarded/malformed inputs and 1.1 µs for a 32-hop chain. These measure request-start processing once per invocation, excluding WAF and I/O. Benchmark files are excluded from this PR.

Contributor Checklist

• Format the title according to the contribution guidelines
• Assign the type: and (comp: or inst:) labels in addition to any other useful labels
• Avoid using close, fix, or any linking keywords when referencing an issue
  Use solves instead, and assign the PR milestone to the issue
• Update the CODEOWNERS file on source file addition, migration, or deletion
• Update public documentation with any new configuration flags or behaviors
• Once approved, use merge queue to merge the PR

Jira ticket: APPSEC-71107

[datadog-datadog-prod-us1]

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 60.01% (+0.04%)

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: c00dd95 | Docs | Give us feedback!}

[dd-octo-sts]

🟢 Java Benchmark SLOs — All performance SLOs passed

Suite	Status
Startup	🟢 pass

SLO thresholds are defined here based on automatically generated metrics. A warning is raised when results are within 5% of the threshold.

PR vs. master results

Scenario	Candidate	master	Δ (95% CI of mean)
startup:insecure-bank:iast:Agent	14.01 s	14.01 s	[-0.7%; +0.8%] (no difference)
startup:insecure-bank:tracing:Agent	12.94 s	13.02 s	[-1.4%; +0.2%] (no difference)
startup:petclinic:appsec:Agent	17.74 s	17.65 s	[-0.4%; +1.5%] (no difference)
startup:petclinic:iast:Agent	17.51 s	17.60 s	[-1.4%; +0.3%] (no difference)
startup:petclinic:profiling:Agent	16.77 s	17.16 s	[-6.7%; +2.1%] (no difference)
startup:petclinic:sca:Agent	17.78 s	17.63 s	[-0.0%; +1.7%] (no difference)
startup:petclinic:tracing:Agent	16.31 s	16.79 s	[-7.1%; +1.4%] (no difference)

Commit: c00dd95b · CI Pipeline · Benchmarking Platform UI

---

Load and DaCapo benchmarks can be triggered manually in the GitLab pipeline. Results will appear in the Benchmarking Platform UI after completion.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-05T13:29:58.930895Z	ce4a747	Draft marked ready
🔒 Security Review	✅ Completed 2026-11-05T13:33:54.861154Z	ce4a747	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[datadog-datadog-prod-us1]

More details

Static review found that Lambda client-IP resolution matches the existing HTTP configuration gates and address precedence, and publishes the inferred address before the socket callback can trigger WAF evaluation.

Was this helpful? React 👍 or 👎

_{Open Bits AI session}

_{🤖 Bits Code Review · Commit ce4a747}

[jandro996]

I've added some non-blocking comments

[datadog-datadog-prod-us1]

The resolver relocation leaves its comprehensive tests in another module, breaking internal-api’s enforced per-class coverage gate. Those tests need to move with the production classes.

_{Open Bits AI session}

_{🤖 Bits Code Review · Commit 4506543}

[bric3]

praise: thx for the migration